linux-hardening - Re: [PATCH net-next v3] net: mana: Allow variable size indirection table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240604090110.GA11436@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net>
Date: Tue, 4 Jun 2024 02:01:10 -0700
From: Shradha Gupta <shradhagupta@...ux.microsoft.com>
To: Leon Romanovsky <leon@...nel.org>
Cc: linux-hardening@...r.kernel.org, netdev@...r.kernel.org,
	linux-hyperv@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-rdma@...r.kernel.org, Colin Ian King <colin.i.king@...il.com>,
	Ahmed Zaki <ahmed.zaki@...el.com>,
	Pavan Chebbi <pavan.chebbi@...adcom.com>,
	Souradeep Chakrabarti <schakrabarti@...ux.microsoft.com>,
	Konstantin Taranov <kotaranov@...rosoft.com>,
	Kees Cook <keescook@...omium.org>, Paolo Abeni <pabeni@...hat.com>,
	Jakub Kicinski <kuba@...nel.org>,
	Eric Dumazet <edumazet@...gle.com>,
	"David S. Miller" <davem@...emloft.net>,
	Dexuan Cui <decui@...rosoft.com>, Wei Liu <wei.liu@...nel.org>,
	Haiyang Zhang <haiyangz@...rosoft.com>,
	"K. Y. Srinivasan" <kys@...rosoft.com>,
	Jason Gunthorpe <jgg@...pe.ca>, Long Li <longli@...rosoft.com>,
	Shradha Gupta <shradhagupta@...rosoft.com>
Subject: Re: [PATCH net-next v3] net: mana: Allow variable size indirection
 table

On Tue, Jun 04, 2024 at 11:32:05AM +0300, Leon Romanovsky wrote:
> On Mon, Jun 03, 2024 at 10:36:48PM -0700, Shradha Gupta wrote:
> > On Mon, Jun 03, 2024 at 11:41:22AM +0300, Leon Romanovsky wrote:
> > > On Fri, May 31, 2024 at 08:37:41AM -0700, Shradha Gupta wrote:
> > > > Allow variable size indirection table allocation in MANA instead
> > > > of using a constant value MANA_INDIRECT_TABLE_SIZE.
> > > > The size is now derived from the MANA_QUERY_VPORT_CONFIG and the
> > > > indirection table is allocated dynamically.
> > > > 
> > > > Signed-off-by: Shradha Gupta <shradhagupta@...ux.microsoft.com>
> > > > Reviewed-by: Dexuan Cui <decui@...rosoft.com>
> > > > Reviewed-by: Haiyang Zhang <haiyangz@...rosoft.com>
> > > > ---
> > > >  Changes in v3:
> > > >  * Fixed the memory leak(save_table) in mana_set_rxfh()
> > > > 
> > > >  Changes in v2:
> > > >  * Rebased to latest net-next tree
> > > >  * Rearranged cleanup code in mana_probe_port to avoid extra operations
> > > > ---
> > > >  drivers/infiniband/hw/mana/qp.c               | 10 +--
> > > >  drivers/net/ethernet/microsoft/mana/mana_en.c | 68 ++++++++++++++++---
> > > >  .../ethernet/microsoft/mana/mana_ethtool.c    | 27 +++++---
> > > >  include/net/mana/gdma.h                       |  4 +-
> > > >  include/net/mana/mana.h                       |  9 +--
> > > >  5 files changed, 89 insertions(+), 29 deletions(-)
> > > 
> > > <...>
> > > 
> > > > +free_indir:
> > > > +	apc->indir_table_sz = 0;
> > > > +	kfree(apc->indir_table);
> > > > +	apc->indir_table = NULL;
> > > > +	kfree(apc->rxobj_table);
> > > > +	apc->rxobj_table = NULL;
> > > >  reset_apc:
> > > >  	kfree(apc->rxqs);
> > > >  	apc->rxqs = NULL;
> > > > @@ -2897,6 +2936,7 @@ void mana_remove(struct gdma_dev *gd, bool suspending)
> > > >  {
> > > 
> > > <...>
> > > 
> > > > @@ -2931,6 +2972,11 @@ void mana_remove(struct gdma_dev *gd, bool suspending)
> > > >  		}
> > > >  
> > > >  		unregister_netdevice(ndev);
> > > > +		apc->indir_table_sz = 0;
> > > > +		kfree(apc->indir_table);
> > > > +		apc->indir_table = NULL;
> > > > +		kfree(apc->rxobj_table);
> > > > +		apc->rxobj_table = NULL;
> > > 
> > > Why do you need to NULLify here? Will apc is going to be accessible
> > > after call to mana_remove? or port probe failure?
> > Right, they won't be accessed. This is just for the sake of completeness
> > and to prevent double free in case there are code bug in other place.
> 
> This coding patter is called defensive programming, which is discouraged
> in the kernel. You are not preventing double free, but hiding bugs which
> were possible to be found by various static analysis tools.
> 
> Please don't do it.
> 
> Thanks
Understood, it makes sense. Let me fix this in the next version.

Regards,
Shradha
> 
> > 
> > Regards,
> > Shradha.
> > > 
> > > Thanks